Engineering & Admin
Snowflake Role Reference
The named roles, what each can read and write, and which warehouses each may use. PHI versus de-identified access is gated by role — each user gets the least-privileged role that still does the job.
Role hierarchy
NDP_RWD_DOMAIN_ADMIN_ROLE (human admins + service users) └── RWD_DATA_ENGINEER_ROLE (engineers + dbt service user) ├── RWD_ANALYST_PHI_ROLE │ └── RWD_RESEARCHER_PHI_ROLE │ └── RWD_VIEWER_PHI_ROLE ├── RWD_ANALYST_DEID_ROLE │ └── RWD_RESEARCHER_DEID_ROLE │ └── RWD_VIEWER_DEID_ROLE ├── RWD_NOTEBOOK_USER_ROLE (add-on) └── RWD_STREAMLIT_DEVELOPER_ROLE (add-on)Roles inherit downward: a Data Engineer has all permissions of Analyst, Researcher, and Viewer combined.
Role selection guide
| User type | Recommended role | Reasoning |
|---|---|---|
| BI consumer (dashboards only) | RWD_VIEWER_PHI_ROLE | Read-only on LIMS_COHORTS + DASHBOARD only. |
| Researcher / scientist | RWD_RESEARCHER_PHI_ROLE | Read all curated data; interactive warehouse. |
| CDO analyst / power user | RWD_ANALYST_PHI_ROLE | Everything plus staging, Cortex AI, scratch write. |
| Data engineer | RWD_DATA_ENGINEER_ROLE | Everything plus ETL warehouses, OPERATE/MONITOR. |
Permissions matrix
| Capability | Viewer | Researcher | Analyst | Engineer |
|---|---|---|---|---|
| LIMS_COHORTS / DASHBOARD (SELECT) | ✓ | ✓ | ✓ | ✓ |
| LIMS_PUB foundation (SELECT) | — | ✓ | ✓ | ✓ |
| VARIANTS (SELECT) | — | ✓ | ✓ | ✓ |
| Staging schemas (SELECT) | — | — | ✓ | ✓ |
| Cortex AI features | — | — | ✓ | ✓ |
| RWD_ANALYTICS (write) | — | — | ✓ | ✓ |
| ETL warehouses (OPERATE) | — | — | — | ✓ |
| CREATE ROLE, manage users | — | — | — | — |
Warehouse access by role
| Warehouse | Viewer | Researcher | Analyst | Engineer |
|---|---|---|---|---|
| QUERY_INTERACTIVE_WH | — | USAGE | USAGE | USAGE |
| QUERY_ANALYTICS_WH | — | — | USAGE | USAGE |
| BI_WH | USAGE | — | — | — |
| AI_WH | — | — | USAGE | USAGE |
| ETL_TRANSFORM_WH | — | — | — | USAGE + OPERATE |